CVE-2021-25374

An improper authorization vulnerability in Samsung Members "samsungrewards" scheme for deeplink in versions 2.4.83.9 in Android O(8.1) and below, and 3.9.00.9 in Android P(9.0) and above allows remote attackers to access a user data related with Samsung Account.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1

8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

3.07% chance of exploitation in the next 30 days, 87th percentile

Published

2021-04-09

Updated

2024-08-03

Proof-of-concept exploits (3)

• FSecureLABS/CVE-2021-25374_Samsung-Account-Access32★ · 2024-02-25
• ReversecLabs/CVE-2021-25374_Samsung-Account-Access32★ · 2024-02-25
• WithSecureLabs/CVE-2021-25374_Samsung-Account-Access32★ · 2024-02-25

References

• CVE Record
• NVD entry

Related

• CVE-2016-7255
• CVE-2018-4121
• CVE-2019-15972
• CVE-2019-2525
• CVE-2019-2548
• CVE-2022-45637